One Input port for multiple sources

Graylog Central (peer support)
1

I am currently creating a Graylog test setup with many clients sending to one Graylog server over Syslog TCP.
This Graylog Server forwards part of the messages to another Graylog server.
There will be about 40-50 clients that send their logs via Syslog TCP to the first Graylog server.

Is it sufficient to configure the same TCP destination port (e.g. 601) as input port on Graylog?
Or might it be better to use a dedicated input port for each client?
I’m concerned that many clients trying to establish a TCP connection on the same port will decrease performance.

2

Hey Mirjam,

using one input for this should work, if you do not have an extraordinarily high number of different applications logging to Graylog on each host. I guess each client will log to its local syslog, which is forwarding all log messages to the Graylog server?

3

Hey Dennis,
thanks for your answer. There won’t be many different applications on each host.
And yes, each client will log to its local syslog first.